@open-mercato/core 0.6.7-develop.6862.1.c11a64ce0a → 0.6.7

package/src/modules/entities/api/sidebar-entities.ts

@@ -5,11 +5,9 @@ import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { EntityManager } from '@mikro-orm/core'
 import { CustomEntity } from '@open-mercato/core/modules/entities/data/entities'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
-import type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'
-import { canReadEntityMetadata, getDeclaredCustomEntityRestriction } from '../lib/entityAcl'
 
 export const metadata = {
-  GET: { requireAuth: true, requireFeatures: ['entities.records.view'] },
+  GET: { requireAuth: true },
 }
 
 export async function GET(req: Request) {
@@ -19,11 +17,6 @@ export async function GET(req: Request) {
   const { resolve } = await createRequestContainer()
   const em = resolve('em') as EntityManager
   const cache = resolve('cache') as any
-  const rbac = resolve('rbacService') as RbacService
-  const acl = await rbac.loadAcl(auth.sub ?? '', {
-    tenantId: auth.tenantId,
-    organizationId: auth.orgId ?? null,
-  })
 
   const where: any = { 
     isActive: true,
@@ -34,49 +27,27 @@ export async function GET(req: Request) {
     { $or: [ { tenantId: auth.tenantId ?? undefined as any }, { tenantId: null } ] },
   ]
   
-  const cacheKey = `entities:sidebar:v2:${auth.tenantId || 'null'}`
-  let candidates: Array<{
-    entityId: string
-    label: string
-    href: string
-    accessRestricted: boolean
-  }> | null = null
+  // Try cache first to avoid repeated queries on focus refreshes
+  const cacheKey = `entities:sidebar:${auth.tenantId || 'null'}`
   try {
     if (cache) {
       const cached = await cache.get(cacheKey)
-      if (cached && Array.isArray(cached.candidates)) candidates = cached.candidates
+      if (cached && Array.isArray(cached.items)) return NextResponse.json(cached)
     }
   } catch {}
 
-  if (!candidates) {
-    const entities = await em.find(CustomEntity as any, where as any, { orderBy: { label: 'asc' } as any })
-    candidates = (entities as any[]).map((entity) => ({
-      entityId: entity.entityId,
-      label: entity.label,
-      href: `/backend/entities/user/${encodeURIComponent(entity.entityId)}/records`,
-      accessRestricted: getDeclaredCustomEntityRestriction(entity.entityId)
-        ?? entity.accessRestricted === true,
-    }))
-    try {
-      if (cache) {
-        await cache.set(cacheKey, { candidates }, { tags: [`nav:entities:${auth.tenantId || 'null'}`] })
-      }
-    } catch {}
-  }
+  const entities = await em.find(CustomEntity as any, where as any, { orderBy: { label: 'asc' } as any })
+  
+  const items = (entities as any[]).map((e) => ({
+    entityId: e.entityId,
+    label: e.label,
+    href: `/backend/entities/user/${encodeURIComponent(e.entityId)}/records`
+  }))
 
-  const items = candidates
-    .filter((entity) => canReadEntityMetadata({
-      entityId: entity.entityId,
-      isCustomEntity: true,
-      isRestricted: entity.accessRestricted,
-      acl,
-    }))
-    .map((entity) => ({
-      entityId: entity.entityId,
-      label: entity.label,
-      href: entity.href,
-    }))
   const payload = { items }
+  try {
+    if (cache) await cache.set(cacheKey, payload, { tags: [`nav:entities:${auth.tenantId || 'null'}`] })
+  } catch {}
   return NextResponse.json(payload)
 }
 

package/src/modules/entities/backend/entities/user/[entityId]/records/page.tsx

@@ -1,10 +1,8 @@
 "use client"
 import * as React from 'react'
-import { resolveExtensionPointPattern } from '@open-mercato/shared/modules/widgets/extension-points'
-import { extensionPoints } from '@open-mercato/core/modules/entities/extension-points'
 import { useSearchParams } from 'next/navigation'
 import type { ColumnDef, SortingState } from '@tanstack/react-table'
-import { filterCustomFieldDefs, useCustomFieldDefs, type CustomFieldDefDto } from '@open-mercato/ui/backend/utils/customFieldDefs'
+import { filterCustomFieldDefs, useCustomFieldDefs } from '@open-mercato/ui/backend/utils/customFieldDefs'
 import { Page, PageBody } from '@open-mercato/ui/backend/Page'
 import { DataTable, type DataTableExportFormat } from '@open-mercato/ui/backend/DataTable'
 import type { PreparedExport } from '@open-mercato/shared/lib/crud/exporters'
@@ -23,11 +21,6 @@ import { useGuardedMutation } from '@open-mercato/ui/backend/injection/useGuarde
 import { useT } from '@open-mercato/shared/lib/i18n/context'
 import { ErrorMessage, LoadingMessage } from '@open-mercato/ui/backend/detail'
 import { useRecordsEntityGuard } from '@open-mercato/core/modules/entities/components/useRecordsEntityGuard'
-import {
-  RelationCell,
-  RelationDisplaysProvider,
-  useRecordListRelationDisplays,
-} from '@open-mercato/core/modules/entities/components/RecordListRelationCell'
 
 type RecordsResponse = {
   items: any[]
@@ -103,13 +96,6 @@ function RecordsPageInner({ params }: { params: { entityId?: string } }) {
     enabled: Boolean(entityId),
     keyExtras: [scopeVersion],
   })
-  const relationDefinitions = React.useMemo(
-    () => filterCustomFieldDefs(cfDefs, 'list').filter(
-      (definition): definition is CustomFieldDefDto => definition.kind === 'relation',
-    ),
-    [cfDefs],
-  )
-  const relationDisplaysByField = useRecordListRelationDisplays(relationDefinitions, rawData)
 
   // Fields searched server-side: every visible column plus the base `id`.
   const searchableFields = React.useMemo(() => {
@@ -194,10 +180,7 @@ function RecordsPageInner({ params }: { params: { entityId?: string } }) {
       meta: { priority: idx < 4 ? 1 : idx < 6 ? 2 : idx < 8 ? 3 : idx < maxVisible ? 4 : 5 },
       cell: ({ getValue }: { getValue: () => unknown }) => {
         const v = getValue() as any
-        if (d.kind === 'relation') {
-          return <RelationCell fieldKey={d.key} value={v} fallbackText={normalizeCell(v)} />
-        }
-        return <span className="inline-block max-w-60 truncate align-top" title={normalizeCell(v)}>{normalizeCell(v)}</span>
+        return <span className="truncate max-w-[24ch] inline-block align-top" title={normalizeCell(v)}>{normalizeCell(v)}</span>
       },
     }))
     // Ensure hidden 'id' column exists for sorting/state
@@ -393,83 +376,79 @@ export RECORD_ID="<record uuid>"`}</code></pre>
             </div>
           </div>
         </ContextHelp>
-        <RelationDisplaysProvider displaysByField={relationDisplaysByField}>
-          <DataTable
-            stickyActionsColumn
-            title={`Records: ${entityId}`}
-            entityId={entityId}
-            actions={actions}
-            columns={columns}
-            data={data}
-            perspective={{
-              tableId: resolveExtensionPointPattern(extensionPoints.hosts.userRecordsTable.pattern, { entityId }),
-            }}
-            exporter={exportConfig}
-            filters={baseFilters}
-            filterValues={filterValues}
-            rowActions={(row) => (
-              <RowActions
-                items={[
-                  { id: 'edit', label: 'Edit', href: `/backend/entities/user/${encodeURIComponent(entityId)}/records/${encodeURIComponent(String((row as any).id))}` },
-                  { id: 'delete', label: 'Delete', destructive: true, onSelect: async () => {
-                    const recordId = String((row as any).id)
-                    try {
-                      const confirmed = await confirm({
-                        title: 'Delete this record?',
-                        variant: 'destructive',
-                      })
-                      if (!confirmed) return
-                      await runDeleteMutation({
-                        operation: async () => {
-                          const deleteCall = await withScopedApiRequestHeaders(
-                            buildOptimisticLockHeader((row as any).updatedAt),
-                            () => apiCall(
-                              `/api/entities/records?entityId=${encodeURIComponent(entityId)}&recordId=${encodeURIComponent(recordId)}`,
-                              { method: 'DELETE' },
-                            ),
-                          )
-                          if (!deleteCall.ok) {
-                            await raiseCrudError(deleteCall.response, 'Failed to delete record')
-                          }
-                        },
-                        context: {
-                          formId: deleteMutationContextId,
-                          resourceKind: 'entities.record',
-                          resourceId: recordId,
-                          retryLastMutation: retryDeleteMutation,
-                        },
-                      })
-                      const j = await readApiResultOrThrow<RecordsResponse>(
-                        `/api/entities/records?entityId=${encodeURIComponent(entityId)}&page=${page}&pageSize=${pageSize}`,
-                        undefined,
-                        {
-                          errorMessage: 'Failed to reload records',
-                          fallback: { items: [], total: 0, page, pageSize, totalPages: 1 },
-                        },
-                      )
-                      setRawData(j.items || [])
-                      setTotal(j.total || 0)
-                      setTotalPages(j.totalPages || 1)
-                      flash('Record has been removed', 'success')
-                    } catch (error) {
-                      const message = error instanceof Error ? error.message : 'Failed to delete record'
-                      flash(message, 'error')
-                    }
-                  } },
-                ]}
-              />
-            )}
-            sortable
-            sorting={sorting}
-            onSortingChange={setSorting}
-            searchValue={search}
-            onSearchChange={(v) => { setSearch(v); setPage(1) }}
-            onFiltersApply={(vals) => { setFilterValues(vals); setPage(1) }}
-            onFiltersClear={() => { setFilterValues({}); setPage(1) }}
-            pagination={{ page, pageSize, total, totalPages, onPageChange: setPage }}
-            isLoading={loading}
-          />
-        </RelationDisplaysProvider>
+        <DataTable
+          stickyActionsColumn
+          title={`Records: ${entityId}`}
+          entityId={entityId}
+          actions={actions}
+          columns={columns}
+          data={data}
+          perspective={{ tableId: `entities.user.records.${entityId}` }}
+          exporter={exportConfig}
+          filters={baseFilters}
+          filterValues={filterValues}
+          rowActions={(row) => (
+            <RowActions
+              items={[
+                { id: 'edit', label: 'Edit', href: `/backend/entities/user/${encodeURIComponent(entityId)}/records/${encodeURIComponent(String((row as any).id))}` },
+                { id: 'delete', label: 'Delete', destructive: true, onSelect: async () => {
+                  const recordId = String((row as any).id)
+                  try {
+                    const confirmed = await confirm({
+                      title: 'Delete this record?',
+                      variant: 'destructive',
+                    })
+                    if (!confirmed) return
+                    await runDeleteMutation({
+                      operation: async () => {
+                        const deleteCall = await withScopedApiRequestHeaders(
+                          buildOptimisticLockHeader((row as any).updatedAt),
+                          () => apiCall(
+                            `/api/entities/records?entityId=${encodeURIComponent(entityId)}&recordId=${encodeURIComponent(recordId)}`,
+                            { method: 'DELETE' },
+                          ),
+                        )
+                        if (!deleteCall.ok) {
+                          await raiseCrudError(deleteCall.response, 'Failed to delete record')
+                        }
+                      },
+                      context: {
+                        formId: deleteMutationContextId,
+                        resourceKind: 'entities.record',
+                        resourceId: recordId,
+                        retryLastMutation: retryDeleteMutation,
+                      },
+                    })
+                    const j = await readApiResultOrThrow<RecordsResponse>(
+                      `/api/entities/records?entityId=${encodeURIComponent(entityId)}&page=${page}&pageSize=${pageSize}`,
+                      undefined,
+                      {
+                        errorMessage: 'Failed to reload records',
+                        fallback: { items: [], total: 0, page, pageSize, totalPages: 1 },
+                      },
+                    )
+                    setRawData(j.items || [])
+                    setTotal(j.total || 0)
+                    setTotalPages(j.totalPages || 1)
+                    flash('Record has been removed', 'success')
+                  } catch (error) {
+                    const message = error instanceof Error ? error.message : 'Failed to delete record'
+                    flash(message, 'error')
+                  }
+                } },
+              ]}
+            />
+          )}
+          sortable
+          sorting={sorting}
+          onSortingChange={setSorting}
+          searchValue={search}
+          onSearchChange={(v) => { setSearch(v); setPage(1) }}
+          onFiltersApply={(vals) => { setFilterValues(vals); setPage(1) }}
+          onFiltersClear={() => { setFilterValues({}); setPage(1) }}
+          pagination={{ page, pageSize, total, totalPages, onPageChange: setPage }}
+          isLoading={loading}
+        />
       </PageBody>
       {ConfirmDialogElement}
     </Page>

package/src/modules/entities/backend/entities/user/create/page.tsx

@@ -10,7 +10,6 @@ import { useRouter } from 'next/navigation'
 import { pushWithFlash } from '@open-mercato/ui/backend/utils/flash'
 import { readApiResultOrThrow } from '@open-mercato/ui/backend/utils/apiCall'
 import { LoadingMessage } from '@open-mercato/ui/backend/detail'
-import { flash } from '@open-mercato/ui/backend/FlashMessages'
 
 const schema = upsertCustomEntitySchema
 
@@ -25,23 +24,15 @@ export default function CreateEntityPage() {
   React.useEffect(() => {
     let active = true
     ;(async () => {
-      try {
-        const data = await readApiResultOrThrow<{ newEntitiesRestrictedByDefault?: boolean }>(
-          '/api/entities/entity-settings',
-          undefined,
-          {
-            errorMessage: t('entities.userEntities.errors.settingsLoadFailed', 'Could not load default restriction policy; using default'),
-            fallback: { newEntitiesRestrictedByDefault: false },
-          },
-        )
-        if (active) setDefaultRestricted(data?.newEntitiesRestrictedByDefault === true)
-      } catch {
-        flash(t('entities.userEntities.errors.settingsLoadFailed', 'Could not load default restriction policy; using default'), 'warning')
-        if (active) setDefaultRestricted(false)
-      }
+      const data = await readApiResultOrThrow<{ newEntitiesRestrictedByDefault?: boolean }>(
+        '/api/entities/entity-settings',
+        undefined,
+        { errorMessage: '[internal] Failed to load entity settings', fallback: { newEntitiesRestrictedByDefault: false } },
+      ).catch(() => ({ newEntitiesRestrictedByDefault: false }))
+      if (active) setDefaultRestricted(data?.newEntitiesRestrictedByDefault === true)
     })()
     return () => { active = false }
-  }, [t])
+  }, [])
   const fields = React.useMemo<CrudField[]>(() => ([
     {
       id: 'entityId',

package/src/modules/entities/cli.ts

@@ -23,7 +23,6 @@ import {
   parseDecryptedFieldValue,
 } from '@open-mercato/shared/lib/encryption/tenantDataEncryptionService'
 import { resolveEntityIdFromMetadata } from '@open-mercato/shared/lib/encryption/entityIds'
-import { listEntityMetadata } from '@open-mercato/shared/lib/db/entityMetadata'
 import { Organization } from '../directory/data/entities'
 import crypto from 'node:crypto'
 
@@ -264,28 +263,8 @@ function resolveEncryptionMapModules(): Module[] {
   }
 }
 
-/**
- * Entity ids whose encryption map is declared in module code with `keyScope: 'system'`.
- *
- * Their ciphertext is sealed under a `system:<entityId>` DEK that has no tenant, so every
- * tenant-scoped command here MUST leave them alone: re-wrapping such a value under a tenant
- * DEK produces a payload runtime decryption can never read again. `backfill-system-encryption`
- * is the one command that handles them.
- */
-function getSystemScopedEntityIds(): Set<string> {
-  return new Set(
-    getDefaultEncryptionMaps(resolveEncryptionMapModules())
-      .filter((map) => map.keyScope === 'system')
-      .map((map) => map.entityId),
-  )
-}
-
 async function upsertEncryptionMaps(em: any, tenantId: string, organizationId: string | null, logger: (msg: string) => void) {
   for (const spec of getDefaultEncryptionMaps(resolveEncryptionMapModules())) {
-    if (spec.keyScope === 'system') {
-      logger(`Skipping ${spec.entityId}: system-scoped map, resolved from module code rather than a tenant row.`)
-      continue
-    }
     const existing = await em.findOne(EncryptionMap, {
       entityId: spec.entityId,
       tenantId,
@@ -399,7 +378,9 @@ function resolveProperty(meta: any, field: string): { columnName: string | null;
 }
 
 function buildEntityMetaRegistry(em: any): Map<string, any> {
-  const allMeta = listEntityMetadata(em)
+  const registry = em?.getMetadata?.()
+  const allMetaRaw = typeof registry?.getAll === 'function' ? registry.getAll() : []
+  const allMeta = Array.isArray(allMetaRaw) ? allMetaRaw : Object.values(allMetaRaw ?? {})
   const metaByEntityId = new Map<string, any>()
   for (const meta of allMeta) {
     const resolved = resolveEntityIdFromMetadata(meta)
@@ -433,21 +414,6 @@ function resolveMapMeta(
   return { entityId, meta, fields, tenantId }
 }
 
-function isEncryptedPayload(value: unknown): boolean {
-  if (typeof value !== 'string') return false
-  const parts = value.split(':')
-  return parts.length === 4 && parts[3] === 'v1'
-}
-
-function formatValueForColumn(prop: any, value: unknown): unknown {
-  if (value === null || value === undefined) return value
-  const types = Array.isArray(prop?.columnTypes) ? prop.columnTypes : []
-  const type = String(prop?.type ?? '').toLowerCase()
-  const isJson = types.some((entry: string) => entry.toLowerCase().includes('json')) || type === 'json' || type === 'jsonb'
-  if (!isJson) return value
-  return JSON.stringify(value)
-}
-
 const rotateEncryptionKey: ModuleCli = {
   command: 'rotate-encryption-key',
   async run(rest) {
@@ -504,25 +470,32 @@ const rotateEncryptionKey: ModuleCli = {
       }
     }
 
+    const isEncryptedPayload = (value: unknown): boolean => {
+      if (typeof value !== 'string') return false
+      const parts = value.split(':')
+      return parts.length === 4 && parts[3] === 'v1'
+    }
+
     const metaByEntityId = buildEntityMetaRegistry(em)
 
     const where: any = { deletedAt: null }
     if (tenantIdArg) where.tenantId = tenantIdArg
     if (organizationIdArg) where.organizationId = organizationIdArg
-    const allMaps = await em.find(EncryptionMap, where)
-    const systemScopedEntityIds = getSystemScopedEntityIds()
-    const maps = allMaps.filter((map: EncryptionMap) => {
-      if (!systemScopedEntityIds.has(String(map.entityId))) return true
-      console.warn(
-        `Skipping ${map.entityId}: system-scoped entity. Its ciphertext is sealed under a system key and cannot be rotated with a tenant key — use "mercato entities backfill-system-encryption" instead.`,
-      )
-      return false
-    })
+    const maps = await em.find(EncryptionMap, where)
     if (!maps.length) {
       console.log('No encryption maps found for the selected scope.')
       return
     }
 
+    const formatValueForColumn = (prop: any, value: unknown): unknown => {
+      if (value === null || value === undefined) return value
+      const types = Array.isArray(prop?.columnTypes) ? prop.columnTypes : []
+      const type = String(prop?.type ?? '').toLowerCase()
+      const isJson = types.some((entry: string) => entry.toLowerCase().includes('json')) || type === 'json' || type === 'jsonb'
+      if (!isJson) return value
+      return JSON.stringify(value)
+    }
+
     const resolveScopes = async (tenantId: string, organizationId: string | null) => {
       if (organizationId) return [{ tenantId, organizationId }]
       const orgs = await em.find(Organization, { tenant: tenantId })
@@ -726,15 +699,7 @@ const decryptDatabase: ModuleCli = {
     const mapWhere: any = { tenantId: tenantIdArg, deletedAt: null, isActive: true }
     if (organizationIdArg) mapWhere.organizationId = organizationIdArg
     if (entityIdArg) mapWhere.entityId = entityIdArg
-    const allMaps = await em.find(EncryptionMap, mapWhere)
-    const systemScopedEntityIds = getSystemScopedEntityIds()
-    const maps = allMaps.filter((map: EncryptionMap) => {
-      if (!systemScopedEntityIds.has(String(map.entityId))) return true
-      console.warn(
-        `Skipping ${map.entityId}: system-scoped entity. Its ciphertext is sealed under a system key that the tenant DEK cannot open, so this command leaves it untouched.`,
-      )
-      return false
-    })
+    const maps = await em.find(EncryptionMap, mapWhere)
 
     if (!maps.length) {
       console.log('No active encryption maps found for the selected scope.')
@@ -1021,187 +986,5 @@ const decryptDatabase: ModuleCli = {
   },
 }
 
-/**
- * Encrypt rows that a **system-scoped** encryption map covers but that were written
- * before the map existed.
- *
- * `rotate-encryption-key` cannot reach them: it walks the `encryption_maps` table and
- * skips every row without a `tenant_id`, while system-scoped maps are declared in module
- * code (`defaultEncryptionMaps` with `keyScope: 'system'`) and cover pre-tenant records
- * that have no tenant at all — onboarding requests being the first such entity. Without a
- * backfill those historical rows stay plaintext forever, since only the write path
- * encrypts.
- *
- * The command is forward-only (plaintext → ciphertext), never accepts an old key and never
- * decrypts, so it cannot re-encrypt data under the wrong key. It is idempotent: values that
- * already decrypt under the current system DEK are left untouched by
- * `encryptEntityPayload`, so a partial run can simply be repeated.
- */
-const backfillSystemEncryption: ModuleCli = {
-  command: 'backfill-system-encryption',
-  async run(rest) {
-    const args = parseArgs(rest)
-    const entityIdArg = (args.entity as string) || null
-    const dryRun = Boolean(args['dry-run'] || args.dry)
-    const batchSize = Math.max(1, parseInt(String(args['batch-size'] || args.batchSize || '500'), 10) || 500)
-    const debug = Boolean(args.debug)
-
-    if (!isTenantDataEncryptionEnabled()) {
-      console.error('TENANT_DATA_ENCRYPTION is disabled; aborting. Enable encryption before backfilling.')
-      return
-    }
-
-    const systemMaps = getDefaultEncryptionMaps(resolveEncryptionMapModules()).filter((map) => map.keyScope === 'system')
-    if (!systemMaps.length) {
-      console.log('No system-scoped encryption maps are declared by the installed modules. Nothing to backfill.')
-      return
-    }
-    const selectedMaps = entityIdArg ? systemMaps.filter((map) => map.entityId === entityIdArg) : systemMaps
-    if (!selectedMaps.length) {
-      console.error(`No system-scoped encryption map declared for entity "${entityIdArg}".`)
-      console.error(`Known system-scoped entities: ${systemMaps.map((map) => map.entityId).join(', ')}`)
-      return
-    }
-
-    const { resolve } = await createRequestContainer()
-    const em = resolve('em') as any
-    const conn: any = em?.getConnection?.()
-    if (!conn || typeof conn.execute !== 'function') {
-      console.error('Unable to access raw database connection; aborting.')
-      return
-    }
-
-    const encryptionService = new TenantDataEncryptionService(em as any, {
-      kms: createKmsService(),
-      defaultEncryptionMaps: systemMaps,
-    })
-    if (!encryptionService.isEnabled()) {
-      console.error('Encryption service is not enabled (KMS unhealthy). Aborting without touching any row.')
-      return
-    }
-
-    const metaByEntityId = buildEntityMetaRegistry(em)
-    const prefix = dryRun ? '[dry-run] ' : ''
-    let totalRowsScanned = 0
-    let totalRowsUpdated = 0
-    let totalRowsUnchanged = 0
-
-    for (const map of selectedMaps) {
-      const entityId = map.entityId
-      const meta = metaByEntityId.get(entityId)
-      if (!meta) {
-        console.warn(`Skipping ${entityId}: entity metadata not found (is the owning module enabled?).`)
-        continue
-      }
-      const tableName = meta?.tableName
-      if (!tableName) {
-        console.warn(`Skipping ${entityId}: entity has no table name.`)
-        continue
-      }
-      const primaryKey = Array.isArray(meta?.primaryKeys) && meta.primaryKeys.length ? meta.primaryKeys[0] : 'id'
-      const { columnName: primaryKeyColumn } = resolveProperty(meta, primaryKey)
-      const pkColumn = primaryKeyColumn ?? primaryKey
-      const qualifiedTable = meta?.schema ? `"${meta.schema}"."${tableName}"` : `"${tableName}"`
-
-      const columns = new Set<string>([pkColumn])
-      for (const rule of map.fields) {
-        const resolved = resolveProperty(meta, rule.field)
-        if (resolved.columnName) columns.add(resolved.columnName)
-        if (rule.hashField) {
-          const resolvedHash = resolveProperty(meta, rule.hashField)
-          if (resolvedHash.columnName) columns.add(resolvedHash.columnName)
-        }
-      }
-      const columnList = Array.from(columns)
-      const selectList = columnList.map((column) => `"${column}"`).join(', ')
-
-      let cursor: unknown = null
-      let entityRowsScanned = 0
-      let entityRowsUpdated = 0
-      let entityRowsUnchanged = 0
-
-      for (;;) {
-        const selectSql = cursor === null
-          ? `select ${selectList} from ${qualifiedTable} order by "${pkColumn}" asc limit ?`
-          : `select ${selectList} from ${qualifiedTable} where "${pkColumn}" > ? order by "${pkColumn}" asc limit ?`
-        const params = cursor === null ? [batchSize] : [cursor, batchSize]
-        const rows = await conn.execute(selectSql, params)
-        const list = Array.isArray(rows) ? rows : []
-        if (!list.length) break
-
-        for (const row of list) {
-          entityRowsScanned += 1
-          cursor = row[pkColumn]
-          const payload: Record<string, unknown> = {}
-          let hasPlaintext = false
-          for (const rule of map.fields) {
-            const resolved = resolveProperty(meta, rule.field)
-            if (!resolved.columnName) continue
-            const rawValue = row[resolved.columnName]
-            payload[rule.field] = rawValue
-            if (rawValue !== null && rawValue !== undefined && !isEncryptedPayload(rawValue)) hasPlaintext = true
-            if (rule.hashField) {
-              const resolvedHash = resolveProperty(meta, rule.hashField)
-              if (resolvedHash.columnName) payload[rule.hashField] = row[resolvedHash.columnName]
-            }
-          }
-          if (!hasPlaintext) continue
-
-          const encrypted = await encryptionService.encryptEntityPayload(entityId, payload, null, null)
-          const updates: Record<string, unknown> = {}
-          for (const rule of map.fields) {
-            const resolved = resolveProperty(meta, rule.field)
-            if (resolved.columnName) {
-              const nextValue = encrypted[rule.field]
-              if (nextValue !== undefined && nextValue !== row[resolved.columnName]) {
-                updates[resolved.columnName] = formatValueForColumn(resolved.prop, nextValue)
-              }
-            }
-            if (rule.hashField) {
-              const resolvedHash = resolveProperty(meta, rule.hashField)
-              const nextHash = encrypted[rule.hashField]
-              if (resolvedHash.columnName && nextHash !== undefined && nextHash !== row[resolvedHash.columnName]) {
-                updates[resolvedHash.columnName] = formatValueForColumn(resolvedHash.prop, nextHash)
-              }
-            }
-          }
-          if (!Object.keys(updates).length) {
-            entityRowsUnchanged += 1
-            if (debug) console.warn(`[backfill-system-encryption] ${entityId} ${String(row[pkColumn])}: plaintext left unchanged`)
-            continue
-          }
-          if (!dryRun) {
-            const setSql = Object.keys(updates).map((column) => `"${column}" = ?`).join(', ')
-            await conn.execute(
-              `update ${qualifiedTable} set ${setSql} where "${pkColumn}" = ?`,
-              [...Object.values(updates), row[pkColumn]],
-            )
-          }
-          entityRowsUpdated += 1
-        }
-
-        if (list.length < batchSize) break
-      }
-
-      totalRowsScanned += entityRowsScanned
-      totalRowsUpdated += entityRowsUpdated
-      totalRowsUnchanged += entityRowsUnchanged
-      console.log(`${prefix}${entityId}: scanned ${entityRowsScanned}, encrypted ${entityRowsUpdated}`)
-    }
-
-    console.log(`\n${prefix}Backfill summary:`)
-    console.log(`  Rows scanned:   ${totalRowsScanned}`)
-    console.log(`  Rows encrypted: ${totalRowsUpdated}`)
-    if (totalRowsUnchanged > 0) {
-      console.warn(
-        `  ⚠ ${totalRowsUnchanged} row(s) held plaintext that could not be encrypted — the system DEK was unavailable. Verify the KMS/fallback key, then re-run (use --debug to list the rows).`,
-      )
-    }
-    if (!dryRun && totalRowsUpdated > 0) {
-      console.log('\n✅ Backfill complete. Re-run with --dry-run to confirm no plaintext rows remain.')
-    }
-  },
-}
-
 // Keep default export stable (install first for help listing)
-export default [seedDefs, reinstallDefs, addField, seedEncryptionMaps, rotateEncryptionKey, decryptDatabase, backfillSystemEncryption]
+export default [seedDefs, reinstallDefs, addField, seedEncryptionMaps, rotateEncryptionKey, decryptDatabase]